How to Eliminate STOP Ransomware (Crypto-Malware/Ransomware)

What is STOP ransomware? And how does it carry out its attack?

STOP ransomware is a file-encrypting virus that first emerged in December last year and was previously known as SUSPENDED ransomware. Apparently it’s back with its new and improved version and is currently targeting computer users at the time of writing. Just like its predecessor, the moment STOP ransomware infiltrates a system, it will scan the computer for certain file types to encrypt such as:
.3gp, .7z, .apk, .avi, .bmp, .cdr, .cer, .chm, .conf, .css, .csv, .dat, .db, .dbf, .djvu, .dbx, .docm, ,doc, .epub, .docx .fb2, .flv, .gif, .gz, .iso .ibooks,.jpeg, .jpg, .key, .mdb .md2, .mdf, .mht, .mobi .mhtm, .mkv, .mov, .mp3, .mp4, .mpg .mpeg, .pict, .pdf, .pps, .pkg, .png, .ppt .pptx, .ppsx, .psd, .rar, .rtf, .scr, .swf, .sav, .tiff, .tif, .tbl, .torrent, .txt, .vsd, .wmv, .xls, .xlsx, .xps, .xml, .ckp, .zip, .java, .py, .asm, .c, .cpp, .cs, .js, .php, .dacpac, .rbw, .rb, .mrg, .dcx, .db3, .sql, .sqlite3, .sqlite, .sqlitedb, .psd, .psp, .pdb, .dxf, .dwg, .drw, .casb, .ccp, .cal, .cmx, .cr2
STOP ransomware uses a combination of AES and RSA 1024 ciphers in encrypting files. Later on, after the encryption, the crypto virus appends the .STOP extension in every file to mark them. Once it is done encrypting and marking the targeted files, STOP ransomware will deliver a ransom note named “!!! YourDataRestore !!!.txt” which contains the following message:
“All your important files were encrypted on this PC.
All files with .STOP extension is encrypted.
Encryption was produced using unique private key RSA-1024 generated for this computer.
To decrypt your files, you need to obtain private key + decrypt software.
To retrieve the private key and decrypt software, you need to contact us by email [email protected] send us an email your !!!YourDataRestore!!!.txt file and wait for further instructions.
For you to be sure, that we can decrypt your files – you can send us a 1-3 and not very big encrypted files and we will send you back it in an original form FREE.
Price for decryption $600 if you contact us first 72 hours.
Your personal id:
[Redacted]
E-mail address to contact us:
[email protected]
Reserve email address to contact us:
[email protected]”
If you are one of the victims of STOP ransomware, unfortunately, there is no way to decrypt the files for free YET. So you have to be patient and use whatever backup copies you have for the meantime until a free decryptor is available.
How does STOP ransomware disseminate its malicious payload?
Malicious spam emails remain to be the distribution used by STOP ransomware, just like its previous version. With the help of social engineering developers of STOP ransomware and other cyber crooks trick users into opening obfuscated attachments and installing the malware like STOP ransomware into the system.
Follow each one of the steps laid out below for successful elimination of STOP ransomware from your computer.
Step 1: Launch the Task Manager by simply tapping Ctrl + Shift + Esc keys on your keyboard.
Step 2: Under the Task Manager, go to the Processes tab and look for any suspicious-looking process which takes up most of your CPU’s resources and is most likely related to STOP ransomware.

Step 3: After that, close the Task Manager.
Step 4: Tap Win + R, type in appwiz.cpl and click OK or tap Enter to open Control Panel’s list of installed programs.
Step 5: Under the list of installed programs, look for STOP ransomware or anything similar and then uninstall it.

Step 6: Next, close Control Panel and tap Win + E keys to launch File Explorer.
Step 7: Navigate to the following locations below and look for STOP ransomware’s malicious components such as [random name].exe and !!! YourDataRestore !!!.txt and other suspicious files, then delete all of them.

%TEMP%
%WINDIR%\System32\Tasks
%APPDATA%\Microsoft\Windows\Templates\
%USERPROFILE%\Downloads
%USERPROFILE%\Desktop

Step 8: Close the File Explorer.
Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use PC Cleaner Pro, this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then, by all means, go on to the next steps.
Step 9: Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step 10: Navigate to the following path:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Step 11: Delete the registry keys and sub-keys created by STOP ransomware.
Step 12: Close the Registry Editor and empty the Recycle Bin.
It is important to make sure that nothing is left behind and that STOP ransomware is completely wiped out from your system. To do that, use the following antivirus program.
Perform a full system scan using SpyRemover Pro. To do so, follow these steps:

Turn on your computer. If it’s already on, you have to reboot
After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit
Windows will now load the SafeMode with Networking.
Press and hold both R key and Windows key.

If done correctly, the Windows Run Box will show up.
Type in explorer http://www.fixmypcfree.com/install/spyremoverpro

A single space must be in between explorer and http. Click OK.

A dialog box will be displayed by Internet Explorer. Click Run to begin downloading the program. The installation will start automatically once a download is done.